Common Weakness Enumeration
CWE-427
Allowed-with-ReviewUncontrolled Search Path Element
Abstraction: Base · Status: Draft
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
1786 vulnerabilities reference this CWE, most recent first.
CVE-2024-5929 (GCVE-0-2024-5929)
Vulnerability from cvelistv5 – Published: 2024-08-21 16:12 – Updated: 2024-08-21 17:42
VLAI
EPSS
VEX
Title
VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Summary
VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Patch Management Agent. The issue results from loading a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22316.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| https://success.vipre.com/en_US/home-windows-rele… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| VIPRE | Advanced Security |
Affected:
12.0.1.214
|
|
| vipre | advanced_security |
Affected:
12.0.1.214
cpe:2.3:a:vipre:advanced_security:*:*:*:*:*:*:*:* |
Date Public
2024-06-20 19:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:vipre:advanced_security:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "advanced_security",
"vendor": "vipre",
"versions": [
{
"status": "affected",
"version": "12.0.1.214"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-21T17:41:44.026618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-21T17:42:18.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Advanced Security",
"vendor": "VIPRE",
"versions": [
{
"status": "affected",
"version": "12.0.1.214"
}
]
}
],
"dateAssigned": "2024-06-12T19:57:05.165Z",
"datePublic": "2024-06-20T19:16:27.138Z",
"descriptions": [
{
"lang": "en",
"value": "VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Patch Management Agent. The issue results from loading a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22316."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-21T16:12:17.122Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-818",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-818/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory"
],
"url": "https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227"
}
],
"source": {
"lang": "en",
"value": "Anonymous"
},
"title": "VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-5929",
"datePublished": "2024-08-21T16:12:17.122Z",
"dateReserved": "2024-06-12T19:57:05.137Z",
"dateUpdated": "2024-08-21T17:42:18.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5509 (GCVE-0-2024-5509)
Vulnerability from cvelistv5 – Published: 2024-06-06 17:51 – Updated: 2024-08-01 21:18
VLAI
EPSS
VEX
Title
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability
Summary
Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22738.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
| https://www.keyshot.com/csirt/ | vendor-advisory |
Impacted products
Date Public
2024-05-31 16:34
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:luxion:keyshot:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "keyshot",
"vendor": "luxion",
"versions": [
{
"status": "affected",
"version": "2023.3.12.2.2.4"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5509",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-07T10:05:16.496885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-07T10:05:29.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:05.317Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-24-540",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-540/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.keyshot.com/csirt/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "KeyShot",
"vendor": "Luxion",
"versions": [
{
"status": "affected",
"version": "2023.3.12.2.2.4"
}
]
}
],
"dateAssigned": "2024-05-29T21:49:37.835Z",
"datePublic": "2024-05-31T16:34:51.821Z",
"descriptions": [
{
"lang": "en",
"value": "Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22738."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T17:51:50.168Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-540",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-540/"
},
{
"name": "vendor-provided URL",
"tags": [
"vendor-advisory"
],
"url": "https://www.keyshot.com/csirt/"
}
],
"source": {
"lang": "en",
"value": "Sean de Regge"
},
"title": "Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-5509",
"datePublished": "2024-06-06T17:51:50.168Z",
"dateReserved": "2024-05-29T21:49:37.803Z",
"dateUpdated": "2024-08-01T21:18:05.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5292 (GCVE-0-2024-5292)
Vulnerability from cvelistv5 – Published: 2024-05-23 21:29 – Updated: 2024-08-01 21:11
VLAI
EPSS
VEX
Title
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Summary
D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21426.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| D-Link | Network Assistant |
Affected:
4.0.0.21
|
Date Public
2024-05-14 15:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-24T17:20:09.250048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:02:34.127Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.662Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-24-443",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-443/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Network Assistant",
"vendor": "D-Link",
"versions": [
{
"status": "affected",
"version": "4.0.0.21"
}
]
}
],
"dateAssigned": "2024-05-23T21:22:34.380Z",
"datePublic": "2024-05-14T15:20:54.270Z",
"descriptions": [
{
"lang": "en",
"value": "D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21426."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-23T21:29:37.136Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-443",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-443/"
}
],
"source": {
"lang": "en",
"value": "Xavier DANEST"
},
"title": "D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-5292",
"datePublished": "2024-05-23T21:29:37.136Z",
"dateReserved": "2024-05-23T21:22:34.350Z",
"dateUpdated": "2024-08-01T21:11:12.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5290 (GCVE-0-2024-5290)
Vulnerability from cvelistv5 – Published: 2024-08-07 08:14 – Updated: 2024-09-18 15:39
VLAI
EPSS
VEX
Summary
An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).
Membership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Canonical Ltd. | wpa_supplicant |
Affected:
2:2.10-15 , < 2:2.10-21ubuntu0.1
(semver)
Affected: 2:2.9.0-21build1 , < 2:2.10-6ubuntu2.1 (semver) Affected: 2:2.9-1ubuntu2 , < 2:2.9-1ubuntu4.4 (semver) Affected: 2.4-0ubuntu10 , < 2:2.6-15ubuntu2.8+esm1 (semver) Affected: 2.4-0ubuntu3 , < 2.4-0ubuntu6.8+esm1 (semver) Affected: 2.1-0ubuntu1 , < 2.1-0ubuntu1.7+esm5 (semver) |
|
| w1.fi | wpa_supplicant |
Affected:
2:2.10-15 , < 2:2.10-21ubuntu0.1
(semver)
Affected: 2:2.9.0-21build1 , < 2:2.10-6ubuntu2.1 (semver) Affected: 2:2.9-1ubuntu2 , < 2:2.9-1ubuntu4.4 (semver) Affected: 2.4-0ubuntu10 , < 2:2.6-15ubuntu2.8+esm1 (semver) Affected: 2.4-0ubuntu3 , < 2.4-0ubuntu6.8+esm1 (semver) Affected: 2.1-0ubuntu1 , < 2.1-0ubuntu1.7+esm5 (semver) cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:w1.fi:wpa_supplicant:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wpa_supplicant",
"vendor": "w1.fi",
"versions": [
{
"lessThan": "2:2.10-21ubuntu0.1",
"status": "affected",
"version": "2:2.10-15",
"versionType": "semver"
},
{
"lessThan": "2:2.10-6ubuntu2.1",
"status": "affected",
"version": "2:2.9.0-21build1",
"versionType": "semver"
},
{
"lessThan": "2:2.9-1ubuntu4.4",
"status": "affected",
"version": "2:2.9-1ubuntu2",
"versionType": "semver"
},
{
"lessThan": "2:2.6-15ubuntu2.8+esm1",
"status": "affected",
"version": "2.4-0ubuntu10",
"versionType": "semver"
},
{
"lessThan": "2.4-0ubuntu6.8+esm1",
"status": "affected",
"version": "2.4-0ubuntu3",
"versionType": "semver"
},
{
"lessThan": "2.1-0ubuntu1.7+esm5",
"status": "affected",
"version": "2.1-0ubuntu1",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5290",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T15:37:32.036314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T15:39:53.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://launchpad.net/ubuntu/+source/",
"defaultStatus": "unaffected",
"modules": [
"runtime API to load OpenSC module or PKCS11 engine or module"
],
"packageName": "wpa",
"platforms": [
"Linux"
],
"product": "wpa_supplicant",
"programFiles": [
"src/crypto/tls_openssl.c"
],
"vendor": "Canonical Ltd.",
"versions": [
{
"lessThan": "2:2.10-21ubuntu0.1",
"status": "affected",
"version": "2:2.10-15",
"versionType": "semver"
},
{
"lessThan": "2:2.10-6ubuntu2.1",
"status": "affected",
"version": "2:2.9.0-21build1",
"versionType": "semver"
},
{
"lessThan": "2:2.9-1ubuntu4.4",
"status": "affected",
"version": "2:2.9-1ubuntu2",
"versionType": "semver"
},
{
"lessThan": "2:2.6-15ubuntu2.8+esm1",
"status": "affected",
"version": "2.4-0ubuntu10",
"versionType": "semver"
},
{
"lessThan": "2.4-0ubuntu6.8+esm1",
"status": "affected",
"version": "2.4-0ubuntu3",
"versionType": "semver"
},
{
"lessThan": "2.1-0ubuntu1.7+esm5",
"status": "affected",
"version": "2.1-0ubuntu1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rory McNamara"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Marc Deslauriers"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sudhakar Verma"
},
{
"lang": "en",
"type": "coordinator",
"value": "Mark Esler"
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root).\n\n\n\n\nMembership in the netdev group or access to the dbus interface of wpa_supplicant allow an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa_supplicant process; other escalation paths might exist."
}
],
"impacts": [
{
"capecId": "CAPEC-641",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-641 DLL Side-Loading"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T15:45:47.115Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"url": "https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613"
},
{
"url": "https://snyk.io/blog/abusing-ubuntu-root-privilege-escalation/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6945-1"
}
],
"source": {
"discovery": "EXTERNAL"
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2024-5290",
"datePublished": "2024-08-07T08:14:08.153Z",
"dateReserved": "2024-05-23T21:10:21.160Z",
"dateUpdated": "2024-09-18T15:39:53.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4132 (GCVE-0-2024-4132)
Vulnerability from cvelistv5 – Published: 2024-10-11 15:16 – Updated: 2024-10-11 17:10
VLAI
EPSS
VEX
Summary
A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | Lock Screen |
Affected:
0 , < 9.0.18
(custom)
|
|
| lenovo | lock_screen |
Affected:
0 , < 9.0.18
(custom)
cpe:2.3:a:lenovo:lock_screen:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lenovo:lock_screen:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "lock_screen",
"vendor": "lenovo",
"versions": [
{
"lessThan": "9.0.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T17:07:10.736004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T17:10:34.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Lock Screen",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "9.0.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks ggid7788 for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.\u003c/span\u003e"
}
],
"value": "A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:16:00.573Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/423563"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpdate Lenovo Lock Screen to version 9.0.18 or later. \u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Update Lenovo Lock Screen to version 9.0.18 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2024-4132",
"datePublished": "2024-10-11T15:16:00.573Z",
"dateReserved": "2024-04-24T13:34:13.806Z",
"dateUpdated": "2024-10-11T17:10:34.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4131 (GCVE-0-2024-4131)
Vulnerability from cvelistv5 – Published: 2024-10-11 15:15 – Updated: 2024-10-11 17:34
VLAI
EPSS
VEX
Summary
A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lenovo:emulator:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "emulator",
"vendor": "lenovo",
"versions": [
{
"lessThan": "9.1.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T17:33:40.497084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T17:34:49.762Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Emulator",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "9.1.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks ggid7788 for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.\u003c/span\u003e"
}
],
"value": "A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:15:51.533Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/423563"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpdate Lenovo Emulator to version 9.1.6 or later. \u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Update Lenovo Emulator to version 9.1.6 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2024-4131",
"datePublished": "2024-10-11T15:15:51.533Z",
"dateReserved": "2024-04-24T13:34:11.821Z",
"dateUpdated": "2024-10-11T17:34:49.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4130 (GCVE-0-2024-4130)
Vulnerability from cvelistv5 – Published: 2024-10-11 15:15 – Updated: 2024-10-11 17:52
VLAI
EPSS
VEX
Summary
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lenovo:app_store:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "app_store",
"vendor": "lenovo",
"versions": [
{
"lessThan": "9.0.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T17:51:48.265071Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T17:52:59.940Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "App Store",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "9.0.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks ggid7788 for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. \u003c/span\u003e"
}
],
"value": "A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:15:41.059Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/423563"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eUpdate Lenovo App Store to version 9.0.17 or later. \u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "Update Lenovo App Store to version 9.0.17 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2024-4130",
"datePublished": "2024-10-11T15:15:41.059Z",
"dateReserved": "2024-04-24T13:34:10.105Z",
"dateUpdated": "2024-10-11T17:52:59.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4089 (GCVE-0-2024-4089)
Vulnerability from cvelistv5 – Published: 2024-10-11 15:15 – Updated: 2024-10-11 16:14
VLAI
EPSS
VEX
Summary
A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:lenovo:superfile:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "superfile",
"vendor": "lenovo",
"versions": [
{
"lessThan": "2.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-11T16:11:34.026155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T16:14:59.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SuperFile",
"vendor": "Lenovo",
"versions": [
{
"lessThan": "2.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lenovo thanks ggid7788 for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. \u003c/span\u003e"
}
],
"value": "A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-11T15:15:29.047Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://iknow.lenovo.com.cn/detail/423563"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update Lenovo Super File to version 2.1 or later. \u003cbr\u003e"
}
],
"value": "Update Lenovo Super File to version 2.1 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2024-4089",
"datePublished": "2024-10-11T15:15:29.047Z",
"dateReserved": "2024-04-23T17:38:18.480Z",
"dateUpdated": "2024-10-11T16:14:59.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2658 (GCVE-0-2024-2658)
Vulnerability from cvelistv5 – Published: 2025-01-30 17:11 – Updated: 2025-01-30 19:22
VLAI
EPSS
VEX
Title
Local privilege escalation in FlexNet Publisher
Summary
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.flexera.com/s/article/cve-2024-… | vendor-advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Flexera | FlexNet Publisher |
Affected:
0 , < 2024 R1 (11.19.6.0)
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T19:22:23.235896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T19:22:27.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "FlexNet Publisher",
"vendor": "Flexera",
"versions": [
{
"lessThan": "2024 R1 (11.19.6.0)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(250, 250, 250);\"\u003eA misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to\u0026nbsp;2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to\u00a02024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create the directory and load a specially crafted openssl.conf file leading to the execution of a malicious DLL (Dynamic-Link Library) with elevated privileges."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T17:11:22.139Z",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.flexera.com/s/article/cve-2024-2658-flexnet-publisher-potential-local-privilege-escalation-issue"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-359/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation in FlexNet Publisher",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2024-2658",
"datePublished": "2025-01-30T17:11:22.139Z",
"dateReserved": "2024-03-19T17:20:18.300Z",
"dateUpdated": "2025-01-30T19:22:27.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2637 (GCVE-0-2024-2637)
Vulnerability from cvelistv5 – Published: 2024-05-14 18:49 – Updated: 2025-04-24 06:52
VLAI
EPSS
VEX
Title
Insecure Loading of Code in B&R Products
Summary
An Uncontrolled Search Path Element vulnerability in B&R Industrial Automation Scene Viewer, B&R Industrial Automation Automation Runtime, B&R Industrial Automation mapp Vision, B&R Industrial Automation mapp View, B&R Industrial Automation mapp Cockpit, B&R Industrial Automation mapp Safety, B&R Industrial Automation VC4, B&R Industrial Automation APROL, B&R Industrial Automation CAN Driver, B&R Industrial Automation CAN Driver CC770, B&R Industrial Automation CAN Driver SJA1000, B&R Industrial Automation Tou0ch Lock, B&R Industrial Automation B&R Single-Touch Driver, B&R Industrial Automation Serial User Mode Touch Driver, B&R Industrial Automation Windows Settings Changer (LTSC), B&R Industrial Automation Windows Settings Changer (2019 LTSC), B&R Industrial Automation Windows 10 Recovery Solution, B&R Industrial Automation ADI driver universal, B&R Industrial Automation ADI Development Kit, B&R Industrial Automation ADI .NET SDK, B&R Industrial Automation SRAM driver, B&R Industrial Automation HMI Service Center, B&R Industrial Automation HMI Service Center Maintenance, B&R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B&R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B&R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
31 products
| Vendor | Product | Version | |
|---|---|---|---|
| B&R Industrial Automation | Scene Viewer |
Affected:
0 , < 4.4.0
(custom)
|
|
| B&R Industrial Automation | Automation Runtime |
Affected:
0 , < J4.93
(custom)
|
|
| B&R Industrial Automation | mapp Vision |
Affected:
0 , < 5.26.1
(custom)
|
|
| B&R Industrial Automation | mapp View |
Affected:
0 , < 5.24.2
(custom)
|
|
| B&R Industrial Automation | mapp Cockpit |
Affected:
0 , < 5.24.2
(custom)
|
|
| B&R Industrial Automation | mapp Safety |
Affected:
0 , < 5.24.2
(custom)
|
|
| B&R Industrial Automation | VC4 |
Affected:
0 , < 4.73.2
(custom)
|
|
| B&R Industrial Automation | APROL |
Affected:
0 , < 4.4-01
(custom)
|
|
| B&R Industrial Automation | CAN Driver |
Affected:
0 , < 1.1.0
(custom)
|
|
| B&R Industrial Automation | CAN Driver CC770 |
Affected:
0 , < 3.3.0
(custom)
|
|
| B&R Industrial Automation | CAN Driver SJA1000 |
Affected:
0 , < 1.3.0
(custom)
|
|
| B&R Industrial Automation | Tou0ch Lock |
Affected:
0 , < 2.1.0
(custom)
|
|
| B&R Industrial Automation | B&R Single-Touch Driver |
Affected:
0 , < 2.0.0
(custom)
|
|
| B&R Industrial Automation | Serial User Mode Touch Driver |
Affected:
0 , < 1.7.1
(custom)
|
|
| B&R Industrial Automation | Windows Settings Changer (LTSC) |
Affected:
0 , < 3.2.0
(custom)
|
|
| B&R Industrial Automation | Windows Settings Changer (2019 LTSC) |
Affected:
0 , < 2.2.0
(custom)
|
|
| B&R Industrial Automation | Windows 10 Recovery Solution |
Affected:
0 , < 3.2.0
(custom)
|
|
| B&R Industrial Automation | ADI driver universal |
Affected:
0 , < 3.2.0
(custom)
|
|
| B&R Industrial Automation | ADI Development Kit |
Affected:
0 , < 5.5.0
(custom)
|
|
| B&R Industrial Automation | ADI .NET SDK |
Affected:
0 , < 4.1.0
(custom)
|
|
| B&R Industrial Automation | SRAM driver |
Affected:
0 , < 1.2.0
(custom)
|
|
| B&R Industrial Automation | HMI Service Center |
Affected:
0 , < 3.1.0
(custom)
|
|
| B&R Industrial Automation | HMI Service Center Maintenance |
Affected:
0 , < 2.1.0
(custom)
|
|
| B&R Industrial Automation | Windows 10 IoT Enterprise 2019 LTSC |
Affected:
0 , ≤ 1.1
(custom)
|
|
| B&R Industrial Automation | KCF Editor |
Affected:
0 , < 1.1.0
(custom)
|
|
| br-automation | scene_viewer |
Affected:
0 , < 4.4.0
(custom)
cpe:2.3:a:br-automation:scene_viewer:*:*:*:*:*:*:*:* |
|
| br-automation | automation_runtime |
Affected:
0 , < j4.93
(custom)
cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:* |
|
| br-automation | mapp_vision |
Affected:
0 , < 5.26.1
(custom)
cpe:2.3:a:br-automation:mapp_vision:*:*:*:*:*:*:*:* |
|
| br-automation | mapp_view |
Affected:
0 , < 5.24.2
(custom)
cpe:2.3:a:br-automation:mapp_view:*:*:*:*:*:*:*:* |
|
| br-automation | mapp_cockpit |
Affected:
0 , < 5.24.2
(custom)
cpe:2.3:a:br-automation:mapp_cockpit:*:*:*:*:*:*:*:* |
|
| br-automation | vc4 |
Affected:
0 , < 4.73.2
(custom)
cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:* |
Date Public
2025-04-02 18:50
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:br-automation:scene_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "scene_viewer",
"vendor": "br-automation",
"versions": [
{
"lessThan": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:br-automation:automation_runtime:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "automation_runtime",
"vendor": "br-automation",
"versions": [
{
"lessThan": "j4.93",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:br-automation:mapp_vision:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mapp_vision",
"vendor": "br-automation",
"versions": [
{
"lessThan": "5.26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:br-automation:mapp_view:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mapp_view",
"vendor": "br-automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:br-automation:mapp_cockpit:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mapp_cockpit",
"vendor": "br-automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:br-automation:vc4:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vc4",
"vendor": "br-automation",
"versions": [
{
"lessThan": "4.73.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2637",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T19:33:12.195778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T14:56:12.677Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:18:48.124Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Scene Viewer",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Automation Runtime",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "J4.93",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Vision",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "5.26.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp View",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Cockpit",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "mapp Safety",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "5.24.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VC4",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "4.73.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "APROL",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "4.4-01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver CC770",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "CAN Driver SJA1000",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "1.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tou0ch Lock",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "B\u0026R Single-Touch Driver",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Serial User Mode Touch Driver",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "1.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows Settings Changer (LTSC)",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows Settings Changer (2019 LTSC)",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows 10 Recovery Solution",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI driver universal",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI Development Kit",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "5.5.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ADI .NET SDK",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "4.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SRAM driver",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "1.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HMI Service Center",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "HMI Service Center Maintenance",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Windows 10 IoT Enterprise 2019 LTSC",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThanOrEqual": "1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "KCF Editor",
"vendor": "B\u0026R Industrial Automation",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-04-02T18:50:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An Uncontrolled Search Path Element vulnerability\u0026nbsp;in B\u0026amp;R Industrial Automation Scene Viewer, B\u0026amp;R Industrial Automation Automation Runtime, B\u0026amp;R Industrial Automation mapp Vision, B\u0026amp;R Industrial Automation mapp View, B\u0026amp;R Industrial Automation mapp Cockpit, B\u0026amp;R Industrial Automation mapp Safety, B\u0026amp;R Industrial Automation VC4, B\u0026amp;R Industrial Automation APROL, B\u0026amp;R Industrial Automation CAN Driver, B\u0026amp;R Industrial Automation CAN Driver CC770, B\u0026amp;R Industrial Automation CAN Driver SJA1000, B\u0026amp;R Industrial Automation Tou0ch Lock, B\u0026amp;R Industrial Automation B\u0026amp;R Single-Touch Driver, B\u0026amp;R Industrial Automation Serial User Mode Touch Driver, B\u0026amp;R Industrial Automation Windows Settings Changer (LTSC), B\u0026amp;R Industrial Automation Windows Settings Changer (2019 LTSC), B\u0026amp;R Industrial Automation Windows 10 Recovery Solution, B\u0026amp;R Industrial Automation ADI driver universal, B\u0026amp;R Industrial Automation ADI Development Kit, B\u0026amp;R Industrial Automation ADI .NET SDK, B\u0026amp;R Industrial Automation SRAM driver, B\u0026amp;R Industrial Automation HMI Service Center, B\u0026amp;R Industrial Automation HMI Service Center Maintenance, B\u0026amp;R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B\u0026amp;R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..\u003cp\u003eThis issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B\u0026amp;R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0.\u003c/p\u003e"
}
],
"value": "An Uncontrolled Search Path Element vulnerability\u00a0in B\u0026R Industrial Automation Scene Viewer, B\u0026R Industrial Automation Automation Runtime, B\u0026R Industrial Automation mapp Vision, B\u0026R Industrial Automation mapp View, B\u0026R Industrial Automation mapp Cockpit, B\u0026R Industrial Automation mapp Safety, B\u0026R Industrial Automation VC4, B\u0026R Industrial Automation APROL, B\u0026R Industrial Automation CAN Driver, B\u0026R Industrial Automation CAN Driver CC770, B\u0026R Industrial Automation CAN Driver SJA1000, B\u0026R Industrial Automation Tou0ch Lock, B\u0026R Industrial Automation B\u0026R Single-Touch Driver, B\u0026R Industrial Automation Serial User Mode Touch Driver, B\u0026R Industrial Automation Windows Settings Changer (LTSC), B\u0026R Industrial Automation Windows Settings Changer (2019 LTSC), B\u0026R Industrial Automation Windows 10 Recovery Solution, B\u0026R Industrial Automation ADI driver universal, B\u0026R Industrial Automation ADI Development Kit, B\u0026R Industrial Automation ADI .NET SDK, B\u0026R Industrial Automation SRAM driver, B\u0026R Industrial Automation HMI Service Center, B\u0026R Industrial Automation HMI Service Center Maintenance, B\u0026R Industrial Automation Windows 10 IoT Enterprise 2019 LTSC, B\u0026R Industrial Automation KCF Editor could allow an authenticated local attacker to execute malicious code by placing specially crafted files in the loading search path..This issue affects Scene Viewer: before 4.4.0; Automation Runtime: before J4.93; mapp Vision: before 5.26.1; mapp View: before 5.24.2; mapp Cockpit: before 5.24.2; mapp Safety: before 5.24.2; VC4: before 4.73.2; APROL: before 4.4-01; CAN Driver: before 1.1.0; CAN Driver CC770: before 3.3.0; CAN Driver SJA1000: before 1.3.0; Tou0ch Lock: before 2.1.0; B\u0026R Single-Touch Driver: before 2.0.0; Serial User Mode Touch Driver: before 1.7.1; Windows Settings Changer (LTSC): before 3.2.0; Windows Settings Changer (2019 LTSC): before 2.2.0; Windows 10 Recovery Solution: before 3.2.0; ADI driver universal: before 3.2.0; ADI Development Kit: before 5.5.0; ADI .NET SDK: before 4.1.0; SRAM driver: before 1.2.0; HMI Service Center: before 3.1.0; HMI Service Center Maintenance: before 2.1.0; Windows 10 IoT Enterprise 2019 LTSC: through 1.1; KCF Editor: before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-641",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-641 DLL Side-Loading"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427 Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T06:52:46.092Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c7d9e49c.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure Loading of Code in B\u0026R Products",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2024-2637",
"datePublished": "2024-05-14T18:49:28.624Z",
"dateReserved": "2024-03-19T08:15:24.368Z",
"dateUpdated": "2025-04-24T06:52:46.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Architecture and Design
Implementation
Strategy: Attack Surface Reduction
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
Mitigation
Implementation
Strategy: Attack Surface Reduction
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
Mitigation
Implementation
Strategy: Attack Surface Reduction
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
Mitigation
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
Mitigation
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
CAPEC-38: Leveraging/Manipulating Configuration File Search Paths
This pattern of attack sees an adversary load a malicious resource into a program's standard path so that when a known command is executed then the system instead executes the malicious component. The adversary can either modify the search path a program uses, like a PATH variable or classpath, or they can manipulate resources on the path to point to their malicious components. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker.
CAPEC-471: Search Order Hijacking
An adversary exploits a weakness in an application's specification of external libraries to exploit the functionality of the loader where the process loading the library searches first in the same directory in which the process binary resides and then in other directories. Exploitation of this preferential search order can allow an attacker to make the loading process load the adversary's rogue library rather than the legitimate library. This attack can be leveraged with many different libraries and with many different loading processes. No forensic trails are left in the system's registry or file system that an incorrect library had been loaded.